Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

unit42.paloaltonetworks.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#11

Post by nixpulvis »

MBCook wrote: post #9

Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many. So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault. And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything. So… meh. These are bugs, they will be fixed. Good on th…

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#13

Post by ecesena »

nixpulvis wrote: post #11
MBCook wrote: post #9

Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many. So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault. And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything. So… meh. These are bugs, they will be fixed. Good on th…

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030...

To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet.

If anyone has direct experience I appreciate to know how it was.

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#14

Post by Terr_ »

nixpulvis wrote: post #11
MBCook wrote: post #9

Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many. So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault. And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything. So… meh. These are bugs, they will be fixed. Good on th…

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

Those are the right questions: While I'd personally prefer full copy/import/export control, having the ability to set up an second key in advance is functionally-similar to having a backup of the first one. If I had my 'druthers:

1. All sites/services would allow the registration of 5 or more keys, which can be tracked/revoked separately. That way if one device is stolen, you can invalidate that key without affecting others.

2. There are two sets of keys: "Regular Use" and "Backup/Recovery".

3. Attempting to use a Backup/Recovery key prompts to user to confirm that they want to invalidate the Regular keys and promote the backup key(s) to the new regular. In this way, a compromised backup cannot be used in secret.

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#16

Post by Gigachad »

ecesena wrote: post #13
nixpulvis wrote: post #11

Earlier quoted context omitted.

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030... To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet. If anyone has direct experience I appreciate to know how it was.

I had a click around Apple Passwords on macos and I could not find a way to move my passkeys to another app. I could only see a way to share them with other Apple Passwords users.

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#17

Post by Gigachad »

colemannugent wrote: post #5

>4. Using the hash of that handshake, the attacker interacts with the victim’s TPM and uses the extracted identity key to sign the handshake hash together with the assertion request Huh? If you have this level of local privileges you can just read session cookies from the browsers store? I guess stealing all the keys is notable, but you can manipulate any password manager with this level of access right? What's the t…

>that synced passkeys should be secure in even in situations involving compromised clients?

I think that is the idea actually. By using secure hardware features it is in theory possible to secure the passkeys even in the case of compromised clients. Like how the iphone uses a security coprocessor to store the decryption keys and face id info out of the reach of iOS.

But this isn't overly concerning since it's still at a minimum as secure as passwords in a local compromise situation.

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#18

Post by BoppreH »

nixpulvis wrote: post #11
MBCook wrote: post #9

Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many. So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault. And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything. So… meh. These are bugs, they will be fixed. Good on th…

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#19

Post by antgiant »

ecesena wrote: post #13
nixpulvis wrote: post #11

Earlier quoted context omitted.

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030... To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet. If anyone has direct experience I appreciate to know how it was.

I can confirm it works on iOS 27. I haven’t tried elsewhere though

Re: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

#20

Post by amluto »

This is someone related to a major TPM pet peeve of mine: the TPM only really cares about global device state and has no concept that a device may be a multi-user system, have multiple processes with different security levels, have multiple tenants, etc.

For example, it really ought to be possible to seal a secret such that it can only be unsealed if PCRs have certain values (the usual TPM thing) and the requester of the unseal operation is tagged by the OS (software TCB) as having a certain identity. The latter part is entirely missing from the TPM spec. (The identity could be a hash of the process, just a UUID, or just about anything else as long as it was reasonably well associated with the process in question. Obviously there are subtleties here.)

If the TPM worked the way I wanted, an unprivileged process running alongside Chrome would be completely unable to use the TPM to pretend to be Chrome.

Post reply on HN